Описание
Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Ссылки
- Third Party AdvisoryUS Government Resource
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 4.2.4502 (включая)
cpe:2.3:a:ecava:integraxor:*:*:*:*:*:*:*:*
EPSS
Процентиль: 56%
0.00336
Низкий
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
EPSS
Процентиль: 56%
0.00336
Низкий
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-200